ci(pr): run a secret-free smoke on PRs, full matrix on demand

.github/workflows/_build-image-kairos-init.yaml

@@ -37,6 +37,16 @@ on:
         type: string
         default: ''
 
+      oci_artifact:
+        description: |
+          When set, also export the image as an OCI layout tarball and
+          upload it as a workflow artifact of this name. The PR pipeline
+          uses this to hand kairos-init to _build-iso.yaml without a
+          registry, because a plain pull_request run has no credentials
+          to push with. Only valid when push is false.
+        type: string
+        default: ''
+
       ref:
         description: 'git ref to check out (defaults to the trigger event ref)'
         type: string
@@ -122,10 +132,25 @@ jobs:
           TAG: ${{ inputs.image_tag }}
           EXTRA_TAG: ${{ inputs.image_extra_tag }}
           PUSH: ${{ inputs.push }}
+          OCI_ARTIFACT: ${{ inputs.oci_artifact }}
         run: |
           set -euo pipefail
+          if [ "$PUSH" = "true" ] && [ -n "$OCI_ARTIFACT" ]; then
+            echo "::error::oci_artifact and push are mutually exclusive"
+            exit 1
+          fi
           args=(--platform "linux/amd64,linux/arm64" -f kairos-init/Dockerfile
                 -t "$REGISTRY/kairos-init:$TAG")
           [ -n "$EXTRA_TAG" ] && args+=(-t "$REGISTRY/kairos-init:$EXTRA_TAG")
           [ "$PUSH" = "true" ] && args+=(--push)
+          [ -n "$OCI_ARTIFACT" ] && args+=(--output "type=oci,dest=$RUNNER_TEMP/kairos-init-oci.tar")
           docker buildx build "${args[@]}" .
+
+      - name: Upload OCI layout
+        if: inputs.oci_artifact != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: ${{ inputs.oci_artifact }}
+          path: ${{ runner.temp }}/kairos-init-oci.tar
+          if-no-files-found: error
+          retention-days: 3

.github/workflows/_build-iso.yaml

@@ -27,6 +27,26 @@ on:
         type: string
         required: true
 
+      kairos_init_artifact:
+        description: |
+          Name of a workflow artifact holding kairos-init as an OCI layout
+          tarball (_build-image-kairos-init.yaml's oci_artifact). When
+          set, `kairos_init_image` is not pulled: it becomes the build
+          context name the layout is bound to, so any name works, e.g.
+          `kairos-init-local`. The PR pipeline uses this because it has
+          no registry to pull from.
+        type: string
+        default: ''
+
+      security_scans:
+        description: |
+          Run the trivy and grype scans and upload their SARIF reports.
+          The PR pipeline turns this off: a pull_request run from a fork
+          gets a read-only token, so the SARIF upload cannot succeed, and
+          master already scans every image that lands.
+        type: boolean
+        default: true
+
       arch:
         description: 'linux/<arch>: amd64, arm64, or riscv64'
         type: string
@@ -243,6 +263,8 @@ jobs:
       build_args: |
         KAIROS_INIT_IMAGE=${{ inputs.kairos_init_image }}
         ${{ inputs.fips && 'FIPS=fips' || '' }}
+      oci_context_artifact: ${{ inputs.kairos_init_artifact }}
+      oci_context_name: ${{ inputs.kairos_init_artifact != '' && inputs.kairos_init_image || '' }}
       base_image: ${{ inputs.base_image }}
       arch: ${{ inputs.arch }}
       model: ${{ inputs.model }}
@@ -287,10 +309,10 @@ jobs:
       kubernetes_distro: ${{ inputs.kubernetes_distro }}
       kubernetes_version: ${{ inputs.kubernetes_version }}
       raw: ${{ inputs.raw }}
-      grype: ${{ inputs.grype }}
-      grype_sarif: ${{ inputs.grype }}
-      trivy: true
-      trivy_sarif: true
+      grype: ${{ inputs.security_scans && inputs.grype }}
+      grype_sarif: ${{ inputs.security_scans && inputs.grype }}
+      trivy: ${{ inputs.security_scans }}
+      trivy_sarif: ${{ inputs.security_scans }}
       sbom: ${{ inputs.sbom }}
       security_scan_mode: 'report-only'
       grype_sarif_fail_build: false

.github/workflows/master.yaml

@@ -4,7 +4,8 @@ name: master
 # uki.yaml / lint.yaml / unit-tests.yaml (deleted together with
 # this rename).
 #
-# Trigger: push to master. Shape mirrors pr.yaml with two
+# Trigger: push to master. Shape mirrors pr-full.yaml (the opt-in
+# full matrix on a PR) with two
 # differences:
 #   - No fork-PR guard (master is trusted).
 #   - Test-before-push semantics for the "master" tag itself:
@@ -59,7 +60,7 @@ jobs:
   # (curl's images/Dockerfile and docker build --platform=linux/riscv64
   # against it; see kairos-io/hadron's Makefile KAIROS_DOCKERFILE_REF).
   # This restores that regression check on every master push, the
-  # earliest point it can be caught, without touching pr.yaml -- every
+  # earliest point it can be caught, without touching pr-full.yaml -- every
   # contributor's PR stays exactly as fast as it is today.
   #
   # Known cost, not hidden: riscv64 under QEMU is slow (observed ~2h+
@@ -80,11 +81,11 @@ jobs:
       matrix_scope: full
     secrets: inherit
 
-  # Flavor smoke matrix. Same shape as pr.yaml's build-flavors, with
+  # Flavor smoke matrix. Same shape as pr-full.yaml's build-flavors, with
   # matrix_scope: full so the riscv64 cells (ubuntu:24.04, debian:13,
   # fedorariscv:42) also run -- their kairos-init tarball only exists
   # at this scope. Runs in parallel with build-image-kairos-init /
-  # build-iso / test-* for the same reason as in pr.yaml.
+  # build-iso / test-* for the same reason as in pr-full.yaml.
   build-flavors:
     needs: build-kairos-init
     uses: ./.github/workflows/_build-flavors.yaml
@@ -130,7 +131,7 @@ jobs:
     secrets: inherit
 
   # ISO matrix split so test-* unblock as soon as the amd64
-  # cells they consume are ready. See pr.yaml for the rationale.
+  # cells they consume are ready. See pr-full.yaml for the rationale.
   # promote-images below waits on build-iso-arm too so a broken
   # arm build still keeps :master-scratch from advancing to :master.
   build-iso:
@@ -141,12 +142,12 @@ jobs:
         include:
           - {name: 'amd64-core', arch: 'amd64', base_image: 'ghcr.io/kairos-io/hadron:v0.5.3', model: 'generic', iso: true, trusted_boot: false, kubernetes_distro: '', fips: false}
           - {name: 'amd64-standard', arch: 'amd64', base_image: 'ghcr.io/kairos-io/hadron:v0.5.3', model: 'generic', iso: true, trusted_boot: false, kubernetes_distro: 'k3s', fips: false}
-          # FIPS core cell (see pr.yaml for rationale).
+          # FIPS core cell (see pr-full.yaml for rationale).
           - {name: 'amd64-core-fips', arch: 'amd64', base_image: 'ghcr.io/kairos-io/hadron-fips:v0.5.1', model: 'generic', iso: true, trusted_boot: false, kubernetes_distro: '', fips: true}
-          # UKI cells feed test-uki (see pr.yaml for the shape).
+          # UKI cells feed test-uki (see pr-full.yaml for the shape).
           - {name: 'amd64-standard-uki', arch: 'amd64', base_image: 'ghcr.io/kairos-io/hadron-trusted:v0.5.1', model: 'generic', iso: true, trusted_boot: true, kubernetes_distro: 'k3s', fips: false}
           - {name: 'amd64-core-uki', arch: 'amd64', base_image: 'ghcr.io/kairos-io/hadron-trusted:v0.5.1', model: 'generic', iso: true, trusted_boot: true, kubernetes_distro: '', fips: false}
-          # Ubuntu 20.04 smoke cell (see pr.yaml for rationale).
+          # Ubuntu 20.04 smoke cell (see pr-full.yaml for rationale).
           - {name: 'amd64-core-ubuntu-20.04', arch: 'amd64', base_image: 'ubuntu:20.04', model: 'generic', iso: true, trusted_boot: false, kubernetes_distro: '', fips: false}
           # Rocky9
           - {name: 'amd64-core-rocky-9', arch: 'amd64', base_image: 'rockylinux/rockylinux:9', model: 'generic', iso: true, trusted_boot: false, kubernetes_distro: '', fips: false}
@@ -279,7 +280,7 @@ jobs:
       release-matcher: ${{ matrix.release-matcher || '' }}
     secrets: inherit
 
-  # FIPS smoke coverage (see pr.yaml for rationale).
+  # FIPS smoke coverage (see pr-full.yaml for rationale).
   test-core-fips:
     needs: build-iso
     strategy:
@@ -307,7 +308,7 @@ jobs:
       container_image_prefix: 'ghcr.io/kairos-io/kairos/${flavor}'
     secrets: inherit
 
-  # Ubuntu 20.04 smoke coverage (see pr.yaml for rationale).
+  # Ubuntu 20.04 smoke coverage (see pr-full.yaml for rationale).
   test-core-ubuntu-20:
     needs: build-iso
     strategy:
@@ -406,7 +407,7 @@ jobs:
       release-matcher: ${{ matrix.release-matcher || '' }}
     secrets: inherit
 
-  # See pr.yaml for the rationale on splitting encryption cells out.
+  # See pr-full.yaml for the rationale on splitting encryption cells out.
   test-standard-encryption:
     needs: [build-iso, build-image-kcrypt-challenger]
     strategy: